The European Data Protection Supervisor and the European Union Agency for Cybersecurity signed a memorandum of understanding to forge a strategic cooperation on data protection and cybersecurity matters.
The Hamburg Commissioner for Data Protection and Freedom of Information published its observations on the proposed EU-U.S. Data Privacy Framework. The HmbBfDI advised data transfer impact assessments must follow the ruling by the Court of Justice of the European Union on lawful EU-U.S. transfers until the proposed DPF is finalized. The regulator also said the U.S.
Israel's Ministry of Justice announced a public consultation on the draft Privacy Protection Regulations for data transfers from European Economic Area nations. The regulations outline obligations for Israeli entities to ensure an adequate level of data protection for data transferred from the EEA. Responsibilities include data retention limits as well as extending rights to deletion, accuracy and notification. The deadline for public comments is Dec. 20.
Italy's data protection authority, the Garante, fined perfume chain Douglas Italia 1.4 million euros for data protection violations. The Garante said the company maintained data of more than 3 million customers without requesting consent for processing.
Amazon Web Services Key Management Service launched a new tool, the External Key Store, enabling customers to protect data with encryption keys under their own control. Customers can “encrypt or decrypt data with cryptographic keys, independent authorization, and audit in an external key management system outside of AWS.” XKS is based on “a new, external root of trust.” Root keys are stored hardware security modules operated by the user.
Snapchat will implement a feature enabling California-based users to ask the application to "limit the use of sensitive personal information," TechCrunch reports. The toggle switch is designed to comply with the California Privacy Rights Act, which takes effect Jan. 1, 2023.
Accounts of more than 5 million Twitter users in Europe and the U.S. may have been compromised, InfoSecurity Magazine reports, citing research from cybersecurity expert Chad Loder. In a Twitter post, Loder said the “breach occurred no earlier than 2021.” His account was suspended after the post. The breach affected users who enabled the “Let others find you by your phone” feature in the discoverability settings. Loder said all accounts for France’s country code of +33 were exposed.
The U.K. Information Commissioner's Office and communications regulator Ofcom released a joint statement on shared regulatory goals around online safety and data protection. The regulators will work closely to ensure policies are consistent and establish clear expectations for organizations to meet both online safety and data protection requirements.
The Parliament of Australia approved final passage of the Privacy Legislation Amendment Bill 2022. The bill amends the Privacy Act of 1988 to increase data breach fines to AU$50 million, or penalties based on data monetization and 30% of adjusted quarterly turnover under a new three-factor penalty scheme.
Reuters reports Twitter is cooperating with an Irish Data Protection Commission probe into implications of recent privacy and security personnel changes.